About the Book

Audience

This book aims to be a comprehensive Apache security resource. As such, it contains a lot of content on the intermediate and advanced levels. If you have previous experience with Apache I expect you will have no trouble jumping to any part of the book straight away. If you are completely new to Apache you will probably need to first spend a little time learning the basics, perhaps reading a general Apache administration book, or taking one of the many tutorials available online. But since Apache Security covers many diverse topics, it's likely that no matter what level of experience you have you are likely to have a solid starting point.

This book does not assume previous knowledge of security. Security concepts relevant for the discussion are introduced and described wherever that is necessary. This is especially true for web application security, which has a whole chapter dedicated to it.

Ultimately, the main thing you should need to do your job in addition to this book, is the Apache web server's excellent reference documentation (http://httpd.apache.org/docs/).

The book should be especially useful for the following four groups of people:

• System administrators, as it is ultimately their job to make web systems secure. This book presents detailed guidance that enables system administrators to make informed decisions about which measures to take to enhance security.
• Programmers, who need to understand how the environment in which their applications are deployed works. In addition, this book shows how certain programming errors lead to vulnerabilities, and tells what to do to avoid such problems.
• System architects, who need to know what both system administrators and programmers do, and who also need to understand how system design decisions affect overall security.
• Web security professionals, who need to understand how the Apache platform works in order to assess the security of systems deployed on it.

Scope

At the time of this writing, there are two major Apache branches in widespread use. The Apache 1.3.x branch is the well-known, and well-tested, web server, and one that led Apache to dominate the web server market. The 2.0.x branch is the next-generation web server, but one that has suffered from the success of the previous branch. Apache 1 is so good that many of its users do not intend to upgrade in the near future. A third branch, 2.2.x is about to become publicly available. Although no one can officially retire an older version, the new 2.2.x branch is a likely candidate for a version to replace Apache 1.3.x. There are very few differences in the way different Apache branches are configured. If you are not a programmer (meaning you do not develop modules to extend Apache), a change from an older branch to a newer branch should be straightforward.

This book covers both current Apache branches. Wherever there are differences in the configuration for the two branches, such differences are clearly explained. The 2.2.x branch is configured in practically the same way as the 2.0.x branch so when the new branch goes officially public the book will apply to it equally well.

Many web security issues are directly related to the operating system Apache runs on. For the majority of this book the operating system you are using is not relevant. The advice I give applies no matter whether you are running some Unix flavor, Windows, or some other operating system. However, in most cases I am assuming you are running Apache on a Unix platform. Although Apache runs well on Windows, Unix platforms offer another layer of configuration options and security features that make them a better choice for security-conscious deployments. Where examples related to the operating system are given, they are typically shown for Linux. But such examples are in general very easy to translate to other Unix platforms and, if you are running a different Unix platform, I trust you will have no problems doing that.

Contents of This Book

I have broken this book into thirteen parts--twelve chapters and one appendix. While doing research for the book I discovered there are two types of people, those who read books from cover to cover, and those who only read those parts that are of immediate interest to them. The structure I have established aims to satisfy both camps. When read sequentially, the book examines how a secure system is built from the ground up, adding layer upon layer of security. However, since every chapter was written to cover a single topic in its entirety, it is possible to read a few selected chapters right now and leave the rest for later. Make sure to read the first chapter, though, as it establishes the foundation for everything else to come.

Chapter 1, Apache Security Principles, first presents essential security principles, security terms, and a view of security as a continuous process. It then goes on to discuss threat modeling, a technique that is used to analyze potential threats and establish defenses. The chapter ends with a discussion of three ways of looking at a web system (the user view, the network view, and the Apache view), each designed to emphasize a different security aspect. This chapter is dedicated to the strategy of deploying a system that is created to be secure, and that is kept secure throughout its lifetime.

Chapter 2, Installation and Configuration, gives comprehensive and detailed coverage of the Apache installation and configuration process, where the main goal is not to get up and running as fast as possible, but to create a secure installation on the first try. Various hardening techniques are presented, along with discussions of the advantages and disadvantages of each.

Chapter 3, PHP, discusses PHP installation and configuration, following the same style as that established in Chapter 2. It begins with discussion of and installation guidance for common PHP deployment models (as an Apache module or as a CGI), continues with descriptions of security-relevant configuration options (such as the safe mode), and concludes with advanced hardening techniques.

Chapter 4, SSL and TLS, discusses cryptography on a level that is necessary and sufficient for the reader to make informed decisions about it. The chapter first establishes the reasons cryptography is needed, then introduces SSL and discusses its strengths and weaknesses. Practical applications of SSL for Apache are covered through descriptions and examples of the use of mod_ssl and OpenSSL. The chapter also specifies the procedures for functioning as a certificate authority, which is required for high security installations.

Chapter 5, Denial of Service Attacks, discusses some dangers of establishing a public presence on the Internet. A denial of service attack is, arguably, one of the problems you are most likely to experience. The types of problems discussed in this chapter include network attacks, configuration and programming issues that can make you harm your own system, local (internal) attacks, weaknesses of the Apache processing model, and plain-old traffic spikes. This chapter describes what can happen, and the actions you can take now, before such attacks occur, to make your system more secure and reduce the potential effects of such attacks. It also gives guidance regarding what to do if such attacks still take place in spite of your efforts.

Chapter 6, Sharing Servers, discusses the problems that arise when common server resources must be shared with people you don't necessarily trust. Resource sharing usually leads to giving other people partial control of the web server. In this chapter I present several ways to give partial control without giving too much. The practical problems this chapter aims to solve are shared hosting, working with developers, and hosting in environments with large numbers of system users (e.g. students).

Chapter 7, Access Control, discusses the theory and practice of identification of users, authentication (verifying a user is allowed to access the system), and authorization (verifying a user is allowed to access a particular resource). For Apache this means coverage of HTTP-defined authentication protocols (Basic and Digest authentication), form-based and certificate-based authentication, and network-level access control. The last part of the chapter discusses single sign-on, whereby people can log in just once and have access to several different resources.

Chapter 8, Logging and Monitoring, describes, in the first part, various ways Apache can be configured to extract interesting and relevant pieces of information, and to record them for later analysis. Specialized logging modules, such as the ones that help detect problems that cause the server to crash, are also covered. In the second part, the chapter addresses the issues of log collection, centralization, and analysis. The third and final part covers operation monitoring, through log analysis in either batch or real-time. A complete example of using mod_status and RRDtool to monitor Apache is presented. (RRDtool is a tool for storing data in a special type of database that does not grow in size.)

Chapter 9, Infrastructure, discusses a wide array of security issues related to the environment in which the Apache web server exists. This chapters touches upon various network security issues, and often gives pointers to web sites and books in which the subject is covered in greater detail. In the second part of this chapter I describe how the introduction of a reverse proxy concept into network design can serve to greatly enhance system security. Advanced (scalable) web architectures, often needed to securely deploy high-traffic systems, are also discussed here.

Chapter 10, Web Application Security, serves as an introduction to that topic. It explains why creating safe web applications is difficult, and where mistakes are likely to happen. It also gives guidance as to how these problems can be solved. Understanding of the issues surrounding web application security is essential to establish an effective defense.

Chapter 11, Web Security Assessment, establishes a set of security assessment procedures. Black-box testing is presented for assessment from the outside. White-box and gray-box testing procedures are described for assessment from the inside.

Chapter 12, Web Intrusion Detection, builds on the material presented in previous chapters, to introduce the concept of web intrusion detection. While the first part of this chapter discusses theory, the second part describes how Apache and mod_security can be used to establish a fully functional open source web intrusion detection system.

Appendix A, Tools, describes some of the most useful web security tools I have found. While it is important to understand how things really work, the tools save time when time is at a premium.